X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/9ce2222dfe0350ab2535775a14e49139fc033f3d..2b4965f56167dfda7c60fc9db2d145698d948fd5:/print-smb.c diff --git a/print-smb.c b/print-smb.c index c7f5f688..68c73659 100644 --- a/print-smb.c +++ b/print-smb.c @@ -12,7 +12,7 @@ #ifndef lint static const char rcsid[] _U_ = - "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.37 2004-12-28 22:29:44 guy Exp $"; + "@(#) $Header: /tcpdump/master/tcpdump/print-smb.c,v 1.47 2007-12-09 00:30:47 guy Exp $"; #endif #include @@ -123,10 +123,10 @@ trans2_qfsinfo(const u_char *param, const u_char *data, int pcnt, int dcnt) fmt = "idFileSystem=[W]\nSectorUnit=[D]\nUnit=[D]\nAvail=[D]\nSectorSize=[d]\n"; break; case 2: - fmt = "CreationTime=[T2]VolNameLength=[B]\nVolumeLabel=[s12]\n"; + fmt = "CreationTime=[T2]VolNameLength=[lb]\nVolumeLabel=[c]\n"; break; case 0x105: - fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[D]\nVolume=[S]\n"; + fmt = "Capabilities=[W]\nMaxFileLen=[D]\nVolNameLen=[lD]\nVolume=[C]\n"; break; default: fmt = "UnknownLevel\n"; @@ -170,8 +170,9 @@ struct smbfnsint trans2_fns[] = { static void -print_trans2(const u_char *words, const u_char *dat _U_, const u_char *buf, const u_char *maxbuf) +print_trans2(const u_char *words, const u_char *dat, const u_char *buf, const u_char *maxbuf) { + u_int bcc; static struct smbfnsint *fn = &trans2_fns[0]; const u_char *data, *param; const u_char *w = words + 1; @@ -209,20 +210,22 @@ print_trans2(const u_char *words, const u_char *dat _U_, const u_char *buf, cons return; } else { smb_fdata(words + 1, - "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[d]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[d]\n", + "TotParam=[d]\nTotData=[d]\nMaxParam=[d]\nMaxData=[d]\nMaxSetup=[b][P1]\nFlags=[w]\nTimeOut=[D]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nDataCnt=[d]\nDataOff=[d]\nSetupCnt=[b][P1]\n", words + 1 + 14 * 2, unicodestr); - smb_fdata(data + 1, "TransactionName=[S]\n%", maxbuf, unicodestr); } f1 = fn->descript.req_f1; f2 = fn->descript.req_f2; } else { smb_fdata(words + 1, - "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[d]\n", + "TotParam=[d]\nTotData=[d]\nRes1=[w]\nParamCnt=[d]\nParamOff=[d]\nParamDisp[d]\nDataCnt=[d]\nDataOff=[d]\nDataDisp=[d]\nSetupCnt=[b][P1]\n", words + 1 + 10 * 2, unicodestr); f1 = fn->descript.rep_f1; f2 = fn->descript.rep_f2; } + TCHECK2(*dat, 2); + bcc = EXTRACT_LE_16BITS(dat); + printf("smb_bcc=%u\n", bcc); if (fn->descript.fn) (*fn->descript.fn)(param, data, pcnt, dcnt); else { @@ -286,13 +289,13 @@ print_browse(const u_char *param, int paramlen, const u_char *data, int datalen) case 0x9: data = smb_fdata(data, - "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken?=[B]\n", + "BROWSE PACKET:\nType=[B] (GetBackupList)\nListCount?=[B]\nToken=[W]\n", maxbuf, unicodestr); break; case 0xa: data = smb_fdata(data, - "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken?=[B]*Name=[S]\n", + "BROWSE PACKET:\nType=[B] (BackupListResponse)\nServerCount?=[B]\nToken=[W]\n*Name=[S]\n", maxbuf, unicodestr); break; @@ -774,8 +777,8 @@ static struct smbfns smb_fns[] = { { SMBnttranss, "SMBnttranss", 0, DEFDESCRIPT }, { SMBntcreateX, "SMBntcreateX", FLG_CHAIN, - { "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[d]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n", - "Path=[S]\n", + { "Com2=[w]\nOff2=[d]\nRes=[b]\nNameLen=[ld]\nFlags=[W]\nRootDirectoryFid=[D]\nAccessMask=[W]\nAllocationSize=[L]\nExtFileAttributes=[W]\nShareAccess=[W]\nCreateDisposition=[W]\nCreateOptions=[W]\nImpersonationLevel=[W]\nSecurityFlags=[b]\n", + "Path=[C]\n", "Com2=[w]\nOff2=[d]\nOplockLevel=[b]\nFid=[d]\nCreateAction=[W]\nCreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W]\nAllocationSize=[L]\nEndOfFile=[L]\nFileType=[w]\nDeviceState=[w]\nDirectory=[b]\n", NULL, NULL } }, @@ -791,7 +794,10 @@ static struct smbfns smb_fns[] = { static void print_smb(const u_char *buf, const u_char *maxbuf) { + u_int16_t flags2; + int nterrcodes; int command; + u_int32_t nterror; const u_char *words, *maxwords, *data; struct smbfns *fn; const char *fmt_smbheader = @@ -800,7 +806,9 @@ print_smb(const u_char *buf, const u_char *maxbuf) TCHECK(buf[9]); request = (buf[9] & 0x80) ? 0 : 1; - unicodestr = EXTRACT_LE_16BITS(&buf[10]) & 0x8000; + flags2 = EXTRACT_LE_16BITS(&buf[10]); + unicodestr = flags2 & 0x8000; + nterrcodes = flags2 & 0x4000; startbuf = buf; command = buf[4]; @@ -818,8 +826,14 @@ print_smb(const u_char *buf, const u_char *maxbuf) /* print out the header */ smb_fdata(buf, fmt_smbheader, buf + 33, unicodestr); - if (buf[5]) - printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7]))); + if (nterrcodes) { + nterror = EXTRACT_LE_32BITS(&buf[5]); + if (nterror) + printf("NTError = %s\n", nt_errstr(nterror)); + } else { + if (buf[5]) + printf("SMBError = %s\n", smb_errstr(buf[5], EXTRACT_LE_16BITS(&buf[7]))); + } smboffset = 32; @@ -890,8 +904,8 @@ print_smb(const u_char *buf, const u_char *maxbuf) printf("\nSMB PACKET: %s (%s) (CHAINED)\n", fn->name, request ? "REQUEST" : "REPLY"); - if (newsmboffset < smboffset) { - printf("Bad andX offset: %u < %u\n", newsmboffset, smboffset); + if (newsmboffset <= smboffset) { + printf("Bad andX offset: %u <= %u\n", newsmboffset, smboffset); break; } smboffset = newsmboffset; @@ -911,17 +925,25 @@ trunc: void nbt_tcp_print(const u_char *data, int length) { - const u_char *maxbuf = data + length; + int caplen; int type; u_int nbt_len; + const u_char *maxbuf; - TCHECK2(data[2], 2); + if (length < 4) + goto trunc; + if (snapend < data) + goto trunc; + caplen = snapend - data; + if (caplen < 4) + goto trunc; + maxbuf = data + caplen; type = data[0]; nbt_len = EXTRACT_16BITS(data + 2); + length -= 4; + caplen -= 4; startbuf = data; - if (maxbuf <= data) - return; if (vflag < 2) { printf(" NBT Session Packet: "); @@ -942,7 +964,12 @@ nbt_tcp_print(const u_char *data, int length) { int ecode; - TCHECK(data[4]); + if (nbt_len < 4) + goto trunc; + if (length < 4) + goto trunc; + if (caplen < 4) + goto trunc; ecode = data[4]; printf("Session Reject, "); @@ -982,13 +1009,17 @@ nbt_tcp_print(const u_char *data, int length) data + 4, 0); if (data == NULL) break; - if (memcmp(data,"\377SMB",4) == 0) { - if (nbt_len > PTR_DIFF(maxbuf, data)) - printf("WARNING: Short packet. Try increasing the snap length (%lu)\n", - (unsigned long)PTR_DIFF(maxbuf, data)); + if (nbt_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) { + if ((int)nbt_len > caplen) { + if ((int)nbt_len > length) + printf("WARNING: Packet is continued in later TCP segments\n"); + else + printf("WARNING: Short packet. Try increasing the snap length by %d\n", + nbt_len - caplen); + } print_smb(data, maxbuf > data + nbt_len ? data + nbt_len : maxbuf); } else - printf("Session packet:(raw data?)\n"); + printf("Session packet:(raw data or continuation?)\n"); break; case 0x81: @@ -1003,29 +1034,33 @@ nbt_tcp_print(const u_char *data, int length) case 0x83: { + const u_char *origdata; int ecode; - TCHECK(data[4]); - ecode = data[4]; - + origdata = data; data = smb_fdata(data, "[P1]NBT SessionReject\nFlags=[B]\nLength=[rd]\nReason=[B]\n", maxbuf, 0); - switch (ecode) { - case 0x80: - printf("Not listening on called name\n"); - break; - case 0x81: - printf("Not listening for calling name\n"); - break; - case 0x82: - printf("Called name not present\n"); - break; - case 0x83: - printf("Called name present, but insufficient resources\n"); - break; - default: - printf("Unspecified error 0x%X\n", ecode); + if (data == NULL) break; + if (nbt_len >= 1 && caplen >= 1) { + ecode = origdata[4]; + switch (ecode) { + case 0x80: + printf("Not listening on called name\n"); + break; + case 0x81: + printf("Not listening for calling name\n"); + break; + case 0x82: + printf("Called name not present\n"); + break; + case 0x83: + printf("Called name present, but insufficient resources\n"); + break; + default: + printf("Unspecified error 0x%X\n", ecode); + break; + } } } break; @@ -1127,12 +1162,13 @@ nbt_udp137_print(const u_char *data, int length) if (qdcount) { printf("QuestionRecords:\n"); - for (i = 0; i < qdcount; i++) + for (i = 0; i < qdcount; i++) { p = smb_fdata(p, "|Name=[n1]\nQuestionType=[rw]\nQuestionClass=[rw]\n#", maxbuf, 0); - if (p == NULL) - goto out; + if (p == NULL) + goto out; + } } if (total) { @@ -1166,6 +1202,8 @@ nbt_udp137_print(const u_char *data, int length) goto out; while (numnames--) { p = smb_fdata(p, "Name=[n2]\t#", maxbuf, 0); + if (p == NULL) + goto out; TCHECK(*p); if (p[0] & 0x80) printf(" "); @@ -1206,7 +1244,47 @@ trunc: return; } +/* + * Print an SMB-over-TCP packet received across tcp on port 445 + */ +void +smb_tcp_print (const u_char * data, int length) +{ + int caplen; + u_int smb_len; + const u_char *maxbuf; + if (length < 4) + goto trunc; + if (snapend < data) + goto trunc; + caplen = snapend - data; + if (caplen < 4) + goto trunc; + maxbuf = data + caplen; + smb_len = EXTRACT_24BITS(data + 1); + length -= 4; + caplen -= 4; + + startbuf = data; + data += 4; + + if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) { + if ((int)smb_len > caplen) { + if ((int)smb_len > length) + printf("WARNING: Packet is continued in later TCP segments\n"); + else + printf("WARNING: Short packet. Try increasing the snap length by %d\n", + smb_len - caplen); + } + print_smb(data, maxbuf > data + smb_len ? data + smb_len : maxbuf); + } else + printf("SMB-over-TCP packet:(raw data or continuation?)\n"); + return; +trunc: + printf("[|SMB]"); + return; +} /* * print a NBT packet received across udp on port 138 @@ -1421,8 +1499,7 @@ ipx_netbios_print(const u_char *data, u_int length) break; if (memcmp(&data[i], "\377SMB", 4) == 0) { smb_fdata(data, "\n>>> IPX transport ", &data[i], 0); - if (data != NULL) - print_smb(&data[i], maxbuf); + print_smb(&data[i], maxbuf); printf("\n"); fflush(stdout); break;